> TODAY'S SUMMARY (29 articles)
Today's cybersecurity news highlights several significant threats and trends. The discovery of the GhostPat vulnerability in Docker Hub (CVE-2026-105445) allows attackers to impersonate users, emphasizing the need for stronger access controls. Additionally, the Hirudo Android Trojan is replacing legitimate banking apps to steal user credentials, posing a growing risk to mobile banking. On the corporate front, the Metropolitan Police faced scrutiny for improperly using a shoplifting platform, underscoring the importance of compliance with privacy regulations. In response to emerging threats, companies like Qualys and Palo Alto Networks are enhancing their cybersecurity tools, with Qualys introducing TruConfidence for automated risk remediation and Palo Alto addressing critical vulnerabilities in its PAN-OS. Meanwhile, Microsoft has dismantled a phishing marketplace responsible for over a billion malicious emails, highlighting the ongoing battle against cybercrime.
|
// AI-powered summary generated at 08:00
Europol coordinated an operation against for-hire distributed denial-of-service (DDoS) services, including the arrest of four people and the takedown of 53 domains.
What AI risk actually means, where it lives, and why most teams get it wrong. Data-backed insights from the 2026 SaaS + AI Security Report.
The post What Is AI Risk? A Clear Definition for 2026 appeared first on Security Boulevard.
Compare the best DAST tools in 2026. Our buyer's guide covers 10 dynamic application security testing solutions, key features, pricing & how to choose the right one.
The post DAST Tools: Complete Buyer’s Guide & 10 Solutions to know in 2026 appeared first on Security Boulevard.
Overview
During a recent malware cleanup investigation, we encountered a compromised Joomla website where the site owner reported a strange issue. Their website displayed a large number of suspicious product links that had nothing to do with their business. These products were not added by the websi...
The timing is off, and it seems to be getting worse. Traditional application security pipelines were designed way back in the days when only humans wrote code … two years ago, that is. Way back then, reviews took hours or days, and post-commit scans could reasonably catch what slipped through. Well...
See how Tenable Hexa AI custom agents empower you to counter machine-speed threats by automating vulnerability remediation. Learn how the Model Context Protocol (MCP) automates execution of risk-driven patching workflows, shifting your strategy from reactive tracking to continuous exposure managemen...
Social engineering: 'low-cost, hard to patch, and scales well' North Korean criminals set on stealing Apple users' credentials and cryptocurrency are using a combination of social engineering and a fake Zoom software update to trick people into manually running malware on their own computers, accord...
A ransomware attack on Cookeville Regional Medical Center hospital (Tennessee) exposed data of 337,000 people after hackers stole 500GB of sensitive information from its systems. A ransomware attack on Cookeville Regional Medical Center (CRMC) in Tennessee led to a major data breach affecting about...
Thor provides an overview of the Q1 2026 vulnerability statistics, highlighting key trends in legacy CVEs and the evolving impact of AI on the threat landscape.
Jaroslav LobaÄŤevski discovered that ESAPI incorrectly validated directory
paths during path verification. An attacker could possibly use this issue
to bypass directory validation checks, leading to control-flow bypass. This
issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
an...
Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously undocumented botnet dubbed PowMix since at least December 2025.
"PowMix employs randomized command-and-control (C2) beaconing intervals, rather than persistent...
On April 6th, 2026, we publicly disclosed a critical Arbitrary File Upload vulnerability in Ninja Forms – File Upload, a WordPress plugin with an estimated 50,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors...
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Netfilter;
- Network traffic control;
(CVE-2026-23060, CVE-2026-23074, CVE-2026-23111)
Explore the top AI security risks in 2026, from OAuth abuse to shadow AI, and how SaaS access drives modern AI threats.
The post AI Security Risks in 2026 appeared first on Security Boulevard.
oFono could be made to crash if it received specially crafted input.
Operation PowerOFF’s latest globally coordinated action identified more than 75,000 alleged cybercriminals. Officials warned each of them to stop jamming up traffic.
The post Officials seize 53 DDoS-for-hire domains in ongoing crackdown appeared first on CyberScoop.
The last generation of Governance, Risk and Compliance (GRC) software built a multi-billion dollar ecosystem by becoming systems of record for risk. ServiceNow became the system of IT workflows. Archer for audits. Diligent for policy management. Own the control framework, own the workflow, own the a...
The Inflection Point Is Here
With Mythos, Anthropic showed that AI can find vulnerabilities in minutes that once took skilled technologists months to find. This shift is a coming storm for developers. How do you handle security remediation when it increases 100-fold?
The post Mythos and the AI...
Bluesky has been experiencing ongoing service disruptions since just before 3 a.m. ET.
L'autorité espagnole de protection des données (AEPD) a publié une décision de sanction à l'encontre de IBERANUNCIOS SL, comprenant le prononcé d'une amende de 9 000 €, pour des manquements en lien avec la sécurité des données personnelles traitées via son portail « tucasa.com ». Cette affaire début...